{"id":"CVE-2024-27834","kind":"vulnerability","aliases":["CVE-2024-27834"],"related":[],"title":"Apple iOS, macOS, Safari: pointer authentication bypass exploited in the wild","description":"Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 have an improper authentication flaw that lets an attacker with arbitrary read and write capability bypass pointer authentication. CISA lists it as known exploited, and a linked report ties n-day exploits to APT29 watering-hole attacks on mobile devices.","severity":"high","cvss":5.5,"epss":null,"exploited":true,"exploited_at":"2026-11-04T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple safari","fixed":["17.5"],"affected":"< 17.5","ecosystem":"vendor"},{"name":"apple ipados","fixed":["17.5"],"affected":"< 17.5","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["17.5"],"affected":"< 17.5","ecosystem":"vendor"},{"name":"apple macos","fixed":["14.5"],"affected":">= 14.0, < 14.5","ecosystem":"vendor"},{"name":"apple tvos","fixed":["17.5"],"affected":"< 17.5","ecosystem":"vendor"},{"name":"apple watchos","fixed":["10.5"],"affected":"< 10.5","ecosystem":"vendor"},{"name":"webkitgtk","fixed":["2.44.2"],"affected":"< 2.44.2","ecosystem":"vendor"},{"name":"wpewebkit wpe webkit","fixed":["2.44.2"],"affected":"< 2.44.2","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 40","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","ios","macos","mobile","safari","vendor"],"not_affected_if":["fully-patched-devices"],"how_to_check":"- Check the device OS version under Settings > General > About (iOS, iPadOS) or About This Mac (macOS) and compare it with the fixed versions.\n- Check the Safari and tvOS/watchOS versions in the same place for each device type in use.","fix":"- Update iOS, iPadOS, macOS, Safari, tvOS and watchOS to a release newer than 10.5; the exact fixed versions are unknown from the sources.","status":"open","published_at":"2024-05-14T15:13:06+00:00","first_seen_at":"2026-11-04T20:56:49+00:00","triaged_at":"2026-11-04T20:57:00+00:00","updated_at":"2026-11-04T22:13:30+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-04T20:57:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS, iPadOS, macOS, Safari, tvOS and watchOS to a release newer than 10.5; the exact fixed versions are unknown from the sources.","reach":"internet","title":"Apple iOS, macOS, Safari: pointer authentication bypass exploited in the wild","impact":"high","summary":"Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 have an improper authentication flaw that lets an attacker with arbitrary read and write capability bypass pointer authentication. CISA lists it as known exploited, and a linked report ties n-day exploits to APT29 watering-hole attacks on mobile devices.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["apple","ios","macos","safari","mobile"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker chains exploit to bypass pointer authentication on devices","analyst_note":"Find Apple's security advisory for 10.5 and the exact fixed versions per product; confirm the exploit chain and user interaction from the APT29 linked report.","how_to_check":"- Check the device OS version under Settings > General > About (iOS, iPadOS) or About This Mac (macOS) and compare it with the fixed versions.\n- Check the Safari and tvOS/watchOS versions in the same place for each device type in use.","plain_action":"Update your iPhone, iPad, Mac and other Apple devices to the latest software version under Settings > General > Software Update.","needs_analyst":true,"not_affected_if":["fully-patched-devices"],"who_is_affected":"Any Apple device running iOS, iPadOS, macOS, Safari, tvOS or watchOS 10.5 or earlier is in scope. The sources describe an attacker who already has arbitrary read and write capability, so the exposure is highest for people targeted by watering-hole or mobile exploit campaigns. Organisations with Apple fleets should treat it as urgent.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4359,"output_tokens":734,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':146C,172C,203C '-2024':13A,16A '-27834':14A,17A '10.5':57B,108C '26':145C,171C,202C 'accord':135C 'action':131C 'adher':199C 'allow':116C 'appl':1A,42B,49B,100C 'apple':18A,21A,23A,25A,28A,30A,32A 'appli':132C 'applic':169C 'apt29':92B 'arbitrari':68B,120C 'asset':193C 'attack':66B,96B,118C 'authent':6A,61B,75B,112C,128C 'base':150C 'bod':144C,170C,201C 'bypass':7A,73B,126C 'capabl':72B,124C 'cisa':76B,129C,142C,159C 'cloud':175C 'complianc':140C 'contain':109C 'could':115C 'cve':12A,15A 'day':89B 'devic':99B 'discontinu':178C 'ensur':139C,198C 'evalu':191C 'exploit':8A,43B,81B,90B 'exposur':196C 'fedora':39A,41A 'fedoraproject':38A,40A 'flaw':62B 'follow':168C 'forens':161C 'guidanc':157C,173C 'guidelin':205C 'hole':95B 'improp':60B,111C 'instruct':138C 'internet':195C 'io':2A,44B,50B,101C 'ipado':51B,102C 'ipados':24A 'iphone':26A 'known':80B 'let':64B 'link':84B 'list':77B 'maco':3A,45B,52B,103C 'macos':29A 'mitig':133C,184C 'mobil':46B,98B 'multiple':19A 'n':88B 'n-day':87B 'note':156C,167C 'os':27A 'patch':204C 'pointer':5A,74B,127C 'priorit':147C 'product':182C 'products':20A 'read':69B,121C 'report':85B 'requir':130C,163C 'respons':189C 'risk':152C 'safari':4A,22A,47B,53B,104C 'secur':148C 'see':153C,164C 'servic':176C 'stakehold':187C 'tie':86B 'triag':162C 'tvos':31A,54B,105C 'unavail':186C 'updat':149C 'url':154C,165C 'use':179C 'vendor':48B,137C 'vulner':113C 'watcho':56B,107C 'watchos':33A 'water':94B 'watering-hol':93B 'webkit':37A 'webkitgtk':34A 'wild':11A 'wpe':36A 'wpewebkit':35A 'write':71B,123C","nicknames":[],"mitigations":[],"who_affected":"Any Apple device running iOS, iPadOS, macOS, Safari, tvOS or watchOS 10.5 or earlier is in scope. The sources describe an attacker who already has arbitrary read and write capability, so the exposure is highest for people targeted by watering-hole or mobile exploit campaigns. Organisations with Apple fleets should treat it as urgent.","tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your iPhone, iPad, Mac and other Apple devices to the latest software version under Settings > General > Software Update.","pkeys":["appleipados","appleiphoneos","applemacos","applemultipleproducts","applesafari","appletvos","applewatchos","fedora","fedoraprojectfedora","ipados","iphoneos","macos","multipleproducts","safari","tvos","watchos","webkitgtk","wpewebkit","wpewebkitwpewebkit"],"ptokens":["apple","fedora","fedoraproject","ipados","iphone","macos","multiple","os","products","safari","tvos","watchos","webkit","webkitgtk","wpe","wpewebkit"],"labels":["apple","exploited","high","ios","macos","mobile","safari","vendor"],"campaign_type":null,"first_public_at":"2024-05-14T15:13:06+00:00","kev":{"dateAdded":"2026-11-04","dueDate":"2026-11-18","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-27834","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27834","severity":null,"published_at":"2026-11-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-04T20:56:49+00:00","fetched_at":"2026-11-04T20:56:49+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-27834","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27834","severity":null,"published_at":"2024-05-14T15:13:06+00:00","modified_at":"2026-11-04T18:17:33+00:00","first_seen_at":"2026-11-04T20:59:06+00:00","fetched_at":"2026-11-04T20:59:06+00:00","note":null}],"documents":[{"id":65815,"url":"https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits","title":"Poisoned Source: APT29 watering holes target mobile devices with n-day exploits","kind":"blog","source":"analyst","publisher":null,"text":"Sekoia TDR: APT29 (Midnight Blizzard) watering hole campaign found mid-October 2026. Three vectors: JS injection on compromised legitimate sites (Ukrainian gas producer, US chemical industry trade association, European far-right party, Bulgarian military-related site), AiTM reverse-proxy lookalikes america250[.]holiday (192.121.46[.]25) and theowo[.]club (188.190.17[.]232), and compromise of Plerdy SEO tracker a.plerdy[.]com/public/js/click/main.js between 27 Aug and 3 Sep 2026. Fingerprinting script 5b4c8fea5cbcee273e8d830f52-temfp.js (UltimateFingerprinter) on static.flux-telemetry[.]com (109.104.106[.]107), edge-ord.clouds-stacks[.]com, redirects to ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com. Exploit chains: iOS 16.7 CVE-2025-43529+CVE-2024-27834 (cookies); iOS 18.5 DarkSword CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520 (full device data, WhatsApp/Telegram, Keychain); Android Chrome 139-145 (not 143) CVE-2026-3910+CVE-2025-27038 (Chrome cookies, logins, Wi-Fi passwords, AndroSnitch). Exfil ad.starx-net[.]com(:8881/telemetry/v12). Marker cookie VDGH_TOKEN_REF. No persistence. All flaws patched; up-to-date devices safe.","published_at":"2026-11-04T00:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":70419,"url":"https://support.apple.com/en-us/HT214101","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":70420,"url":"https://support.apple.com/en-us/HT214102","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":70421,"url":"https://support.apple.com/en-us/HT214103","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":70422,"url":"https://support.apple.com/en-us/HT214104","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":70423,"url":"https://support.apple.com/en-us/HT214106","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"}],"exploit_sources":[{"type":"kev","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27834","date_added":"2026-11-04","due_date":"2026-11-18","ransomware":"Unknown"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}